Culvert VPNWhat an exit IP is, and why the app shows you yours
The exit IP is the address websites see when your VPN is on: the server's, not yours. Here is what it tells you and why an app should verify it.
The exit IP is the public address your traffic carries when it leaves the VPN server for the internet. It is the server's address, not your phone's, and it is what every website, app and service sees while you are connected. When an app shows you your exit IP on the connect screen, it is telling you which address the world currently thinks you have.
Where the name comes from
A VPN tunnel has two ends. Your phone is the entry, and the server is the exit. Packets go in at your end encrypted, come out at the server end decrypted, and the server sends them onward with its own address as the source. That address is the one at the exit, hence exit IP. Some people call it the VPN IP or the server IP; they mean the same thing.
Why it is shared, and why that helps
A server carries many people at once, and every one of them leaves through the same address. From a website's point of view, all of those visitors arrive from one place. That is not a limitation; it is a large part of the point. An address that identifies one server and hundreds of sessions behind it cannot single out a person the way a home address can, and the post on whether a VPN hides your IP address covers what that does and does not protect.
It does mean you sometimes inherit the behaviour of the people who left before you. If a site has seen a lot of automated traffic from an address, it may show you an extra verification step. That is the address's reputation, not yours, and it clears as you use the site normally.
What the exit IP tells you
Three things, all useful.
That the tunnel is carrying your traffic. If the address a server saw belongs to the VPN, your packets went through it. If it is your carrier's address, they did not, whatever the app's status icon says.
Which server you are on. Each server has its own address, so the exit IP identifies the machine inside the city you chose. You will not normally need this, but it is the detail that lets a support conversation start from facts.
Roughly where you appear to be. Websites map addresses to locations using databases of who registered which address block. Those databases are approximate and sometimes stale, so a server in one city can show up as a neighbouring one. The server has not moved; the lookup is wrong.
What it does not tell you
An exit IP is not proof that you are private in any broader sense. It says the address changed, and nothing about the accounts you are signed in to, the cookies in your browser or the identifiers your apps carry. It also says nothing about DNS: your web requests can leave through the server while your name lookups escape to the local network. The IP leak test covers the checks that go beyond the exit address.
Why an app should verify it, not just display it
There are two ways an app can put an address on the screen. It can show the address it expects the server to have, from a list it already holds. Or it can ask a server, through the tunnel, "what address did this request arrive from?" and show the answer.
The first is a label. It will show the right address whether or not the tunnel is working, because it never checked. The second is a measurement: the request had to travel through the tunnel and come out of the server for the answer to be the server's address. If the tunnel is silently broken, the answer is your real address, and the screen says so.
Who is asked matters too. If the app sends that question to a third-party "what is my IP" service, the service learns your exit address, your real address if the tunnel failed, and the fact that you use a VPN, on every connect. Asking the provider's own server keeps the check inside the relationship you already have. Why a VPN should verify its own exit IP goes through the trade-off properly.
When it changes
The exit IP is fixed for a session and can change between sessions. Reconnecting may land you on a different server in the same city because the app chose a healthier one, and providers occasionally retire an address or move a server. If you need the same address for a long time, a VPN is the wrong tool; the addresses are meant to be shared and rotated.
Reading it on the connect screen
A well-designed connect screen shows the exit IP alongside the session's data counters and the time connected. Together those answer the three questions worth asking: is traffic flowing, is it going through the server, and for how long. The post on reading a VPN connect screen explains each field.
Culvert VPN shows the exit IP it verified through the tunnel by asking its own server rather than any third-party site, so the address on screen is a measurement and not a label, and it is free on Google Play.
Questions people also ask
Is the exit IP unique to me?
No. It belongs to the server, and everyone connected to that server at the same time shares it. That sharing is part of what makes it useful.
Why is my exit IP in a different city from the one I picked?
IP geolocation databases guess a location from the address block's registration, and they are often wrong by a city or a region. The server is where the app says it is; the database is out of date.
Can I choose my exit IP?
Not in most apps, and not in Culvert VPN. You choose a country or city; the app picks the healthiest server inside it, and that server's address is your exit IP for the session.